Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
General
-
Target
2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe
-
Size
637KB
-
MD5
6e82252e3ce511a42ba01007dc53b7b5
-
SHA1
0dfd9a3b54c59c3e0455f4e632770cf84626af6d
-
SHA256
2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609
-
SHA512
48b57bcc64b9071f05a718fc05511b00bb34dd351d76bc7828c93b5441fbf7e4fc1c42e844d68ca8f2a9525d7e9d89b9547a88c00ebe9835dab3008edd878679
-
SSDEEP
12288:f8oTmXIyxqNFmhoKAzWgi96IAEy9UhK+8TAQ5+rROXP:EoTWq76oKADi96kyK104If
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 1808 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4984 set thread context of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\plasticitet\adoptionens.spo 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4984 wrote to memory of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87 PID 4984 wrote to memory of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87 PID 4984 wrote to memory of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87 PID 4984 wrote to memory of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87 PID 4984 wrote to memory of 1808 4984 2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"C:\Users\Admin\AppData\Local\Temp\2a5704a75c148a41d3c1d9d17bafa6b150e162819f5196d4b46990ca305ec609.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5b0c77267f13b2f87c084fd86ef51ccfc
SHA1f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA256a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
SHA512f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e